Introduction:
-------------
The USP Secure Entry Serverâ?¢ protects company networks and business
transactions with internet access as a Web application firewall (WAF)
and manages access to data and applications.

The USP Secure Entry Serverâ?¢ (SES) offers this protection by scanning
data packages right down to the individual items of content, thus
reliably safeguarding Web applications and all transactions carried out
using them. The SES acts as an x-ray scanner for online transactions; it
identifies data packages infected by viruses and only approves undamaged
or cleaned data packages for use.[1]

Technical Description
---------------------
By default, the USP Secure Entry Server is shipped with option
HSP_AbsoluteRedirects set to off. The consequence is that after a
successful cookie-check, the server replies with a relative instead of
an absolute link. The server doesn't detect that relative URLs starting
with double slash are in fact detected as a valid domain by browsers and
not just a path on the actual server.

5. The browser doesn't interpret a redirection to //www.hacking-lab.com
as being http(s)://[victim]//www.hacking-lab.com, but in fact as a
redirection to http(s)://www.hacking-lab.com. This behavior is RFC
conform and is well implemented in most current browsers[2]. The client
gets therefore redirected to another website by the SES.

Workaround / Fix:
-----------------
Upgrade to the latest available version of SES or ensure option
HSP_AbsoluteRedirects is set to on (as it's by default in the appliance
but not the software version), as this would insert the FQDN in the
response of the server.

Timeline:
---------
2013-12-18: Coordinated public disclosure date (after 3 months grace period)
2013-09-18: Release of fixed SES Appliance Version 4.7.0 and HSP Software Version 4.5.0
2013-04-26: Initial vendor response
2013-04-23: Initial formal vendor notification based on advisory and CVE-ID
2013-04-07: Assigned CVE-2013-2764
2013-04-03: Discovery of the same issue but with a different customer
2012-09-10: Discussed with a representative of the vendor, which did not consider it as a major issue but customer related
2012-09-06: Discovery by Alexandre Herzog